Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 13:15
Behavioral task
behavioral1
Sample
c375432cd7ec91efa2a9383352aa0c6e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c375432cd7ec91efa2a9383352aa0c6e.exe
Resource
win10v2004-20240226-en
General
-
Target
c375432cd7ec91efa2a9383352aa0c6e.exe
-
Size
55KB
-
MD5
c375432cd7ec91efa2a9383352aa0c6e
-
SHA1
d75c95c8f5186a1ff0f0a79dda0049e6045139da
-
SHA256
8d2fc42cefceba6c8b52b9496d142d5985fc4b85f1a95ca6d3a26221231bbb06
-
SHA512
9effceb3945dcca7bfe622c38205d82f73fb8ec450e48b4730e8b8eea3fe353a1e7ba930216273d0397c87aacc82756a7783c062c088aff4d6093431505ba566
-
SSDEEP
768:LWPK4WyZPvXiwv/kiavoGDhsxzrRGwmEuXheLfjP4VsH3bRkflcJY3HJmCRlxYhE:LqbZPPkiagrrMwm/heLLP4e3g+a3NUE
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1000 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\e2fe90291a.dll c375432cd7ec91efa2a9383352aa0c6e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1000 1072 c375432cd7ec91efa2a9383352aa0c6e.exe 32 PID 1072 wrote to memory of 1000 1072 c375432cd7ec91efa2a9383352aa0c6e.exe 32 PID 1072 wrote to memory of 1000 1072 c375432cd7ec91efa2a9383352aa0c6e.exe 32 PID 1072 wrote to memory of 1000 1072 c375432cd7ec91efa2a9383352aa0c6e.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c375432cd7ec91efa2a9383352aa0c6e.exe"C:\Users\Admin\AppData\Local\Temp\c375432cd7ec91efa2a9383352aa0c6e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$30689.bat2⤵
- Deletes itself
PID:1000
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD52f42b06c7d6f39424f49e984880b2608
SHA1fedf9d82b4d2f9e9d037d3fa3c1efacd27451efa
SHA256c38fefa611c9004e72cd64c2ac96bf2daa51b6b861aa2394126f9585a49b81aa
SHA512bb19a69c2cf8e91e811cdc6d597412afe6b49b225bb81da78aec60ea08f1f9b91f6c1daeef3816f92461a3b0bee194f6e965fbff042bb2fe1801136cefdd77a4